CVE-2024-31319

CVE-2024-31319 affects Android Framework (NotificationManagerService.java). A cross-user data leak caused by a confused deputy could lead to local escalation of privilege with no extra execution privileges required. Exploitation is described as local and independent of user interaction. Public de...

CVE-2024-23697

CVE-2024-23697: A use-after-free in RGXCreateHWRTData_aux (rgxta3d.c) enables possible arbitrary code execution and local kernel privilege escalation. No user interaction required. Documents consistently describe this as a local-privilege escalation vulnerability with kernel impact and do not pro...

CVE-2024-23698

CVE-2024-23698 affects the Android/Linux kernel code path RGXFWChangeOSidPriority in rgxfwutils.c, where a missing bounds check could enable arbitrary code execution and local escalation of privilege with no user interaction. The issue is described consistently across multiple sources (Android An...

CVE-2024-31315

In Android, CVE-2024-31315 affects the ManagedServices.java implementation, where improper input validation in multiple functions could enable hiding an app with notification access via the Device & app notifications settings. The vulnerability is described as enabling local elevation of privileg...

CVE-2024-31316

CVE-2024-31316 affects the Android Framework, specifically the onResult path in AccountManagerService.java. The issue is a parcel mismatch that could allow an arbitrary background activity launch, resulting in local elevation of privilege without requiring additional execution privileges. No user...

CVE-2024-31317

CVE-2024-31317 is a Zygote command-injection vulnerability affecting Android 9–13, enabling a non-privileged app with WRITE_SECURE_SETTINGS to trigger code execution in the Zygote process via unsafe deserialization and manipulated Zygote arguments (e.g., runtime-flags, hidden_api_blacklist_exempt...

CVE-2024-31310

CVE-2024-31310 affects Android: in AutofillManagerServiceImpl.newServiceInfoLocked, improper input validation can allow hiding an enabled Autofill service in the Autofill service settings. Impact is local privilege escalation with high confidentiality/integrity/availability implications, requirin...

CVE-2024-31313

CVE-2024-31313 is an Android/MessageQueueBase.h issue involving an incorrect bounds check in the function availableToWriteBytes, which can cause an out-of-bounds write. The vulnerability enables local escalation of privilege with no additional execution privileges required and does not require us...

CVE-2023-21114

CVE-2023-21114 affects Android devices with a local elevation of privilege due to a confused deputy in components referenced in the Android WiFi stack and related platform code. Exploitation requires local access and does not need user interaction. Multiple vendors’ advisories (e.g., Android secu...

CVE-2023-3288

CVE-2023-3288 affects Easy!Appointments, where a BOLA flaw on POST /providers allows a low-privileged user to create a privileged provider, enabling privilege escalation. Multiple connected sources (including CVELIST entry Easy!Appointments

CVE-2023-3289

CVE-2023-3289 affects Easy!Appointments (versions prior to 1.5.0). A BOLA in POST /services allows a low-privileged user to create a service for any user (including admin), leading to unauthorized data manipulation. The connected documents provide explicit description of the affected endpoint and...

CVE-2023-3286

CVE-2023-3286 affects Easy!Appointments prior to version 1.5.0. The vulnerability is described as a BOLA issue on POST /secretaries that allows a low-privileged user to create another low-privileged secretary account, enabling unauthorized data manipulation. The connected sources consistently fra...

CVE-2023-3285

CVE-2023-3285 refers to an Insecure Authorization (BOLA) in the EasyAppointments web app. The vulnerability resides in the POST /appointments endpoint, where a low-privileged user can create an appointment for any user (including administrators), leading to unauthorized data manipulation. Technic...

CVE-2023-50805

CVE-2023-50805 affects Samsung Mobile Processor, Wearable Processor, and Modems across Exynos 9820/9825/980/990/850/1080/2100/2200/1280/1380/1330/9110/W920/W930, and Exynos Modem 5123/5300. The vulnerability is an out-of-bounds write in the heap encountered in 2G (no authentication required). Mul...

CVE-2023-50806

CVE-2023-50806 affects Samsung Mobile Processor, Wearable Processor, and Modems (Exynos 9820/9825/980/990/850/1080/2100/2200/1280/1380/1330/9110/W920/W930, Exynos Modem 5123, 5300). Description: an out-of-bounds heap-buffer access in the SIM Proactive Command. Impact and likelihood: CVSSv3.1 base...

CVE-2024-28882

OpenVPN versions 2.6.0 through 2.6.10 are vulnerable to a flaw where the server role accepts multiple exit notifications from authenticated clients. This behavior results in the extension of the validity of a closing session , preventing the session from terminating as intended. This issue has be...

CVE-2024-28882

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session...

CVE-2024-28882

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session...

CVE-2024-3651

CVE-2024-3651 affects the kjd/idna Python package (python-idna) and specifically the idna.encode() path in version 3.6. The issue arises when processing crafted input strings, causing quadratic growth in CPU load and resulting in a denial of service. Connected sources (Astra Linux, CIRCL, CBLMari...

CVE-2024-3651

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This...